diff --git a/src/development/vibetype/compose.yaml b/src/development/vibetype/compose.yaml
index c708465c..bbf4b0dc 100644
--- a/src/development/vibetype/compose.yaml
+++ b/src/development/vibetype/compose.yaml
@@ -41,7 +41,7 @@ services:
         - traefik.http.routers.vibetype.middlewares=redirectscheme # dargstack:dev-only
         - traefik.http.routers.vibetype.rule=(Host(`${STACK_DOMAIN}`) || Host(`www.${STACK_DOMAIN}`)) && !PathPrefix(`/api/internal`)
         - traefik.http.routers.vibetype-secure.entryPoints=web-secure
-        - traefik.http.routers.vibetype-secure.middlewares=vibetype-cors,vibetype-redirectregex
+        - traefik.http.routers.vibetype-secure.middlewares=vibetype-cors,vibetype-redirectregex # dargstack:dev-only
         - traefik.http.routers.vibetype-secure.rule=(Host(`${STACK_DOMAIN}`) || Host(`www.${STACK_DOMAIN}`)) && !PathPrefix(`/api/internal`)
         - traefik.http.routers.vibetype-secure.tls.options=mintls13@file # dargstack:dev-only
         - traefik.http.services.vibetype.loadbalancer.server.port=3000
diff --git a/src/production/vibetype/compose.yaml b/src/production/vibetype/compose.yaml
index 91416e37..4936026b 100644
--- a/src/production/vibetype/compose.yaml
+++ b/src/production/vibetype/compose.yaml
@@ -3,7 +3,12 @@ services:
     deploy:
       labels:
         - (( append ))
+        - traefik.http.middlewares.vibetype-ratelimit.ratelimit.average=10
+        - traefik.http.middlewares.vibetype-ratelimit.ratelimit.burst=200
+        - traefik.http.middlewares.vibetype-ratelimit.ratelimit.period=1s
+        - traefik.http.middlewares.vibetype-ratelimit.ratelimit.sourcecriterion.requestheadername=Cf-Connecting-Ip # all requests arrive through the cloudflare tunnel, so the remote address is always the tunnel's
         - traefik.http.routers.vibetype.middlewares=redirectscheme,vibetype-redirectregex
+        - traefik.http.routers.vibetype-secure.middlewares=vibetype-ratelimit,vibetype-cors,vibetype-redirectregex
         - traefik.http.routers.vibetype-secure.tls.certresolver=default
       update_config:
         order: start-first